Cyber-Espionage Hits Major League Baseball: A review of the Cardinals & Chris Correa case

When one thinks of cyber-espionage, images abound of young people with iridescent faces from the glow of computer screens, listening to metal music, and living in their parents’ basement hacking into banks and public systems for thrill, notoriety, and (sometimes) money. Such images are, of course, clichés.

Take Chris Correa: a well-educated baseball outsider in his thirties, who at one time was a doctoral candidate at the University of Michigan and who swiftly rose within the ranks of the St. Louis Cardinals’ front office to become its Scouting Director in late 2014.[1] In 2016, Correa admitted to engaging in cyber-espionage against the Astros, pleading guilty to five counts of federal unauthorized access of a protected computer in violation of 18 U.S.C. 1030(a)(2)(C) & (c)(2)(B)(iii).[2] Then, in January 2017, after concluding his investigation of Correa’s conduct, Major League Baseball (MLB) Commissioner Robert D. Manfred, Jr. banned Correa from the MLB, stripped the Cardinals of their top two 2017 draft picks (awarding them to the Astros), and ordered the Cardinals to pay the Astros $2 million.[3]

This article reviews the Correa case, specifically:

the facts;

the MLB Commissioner’s powers;

the decision; and

author’s analysis.

Facts

In 2009, Correa joined the Cardinals to perform statistical analysis.[4] But Correa was quickly on the rise.[5] By late 2014, the Cardinals named Correa Director of Scouting.[6] The MLB even published an article about him, noting his swift rise within the Cardinals club and quoting people within the Cardinals organization who described him as a “leader,” “gung-ho from day one,” and “on top of everything.”[7]

In late 2011, two Cardinals employees left to join the Astros -- Jeff Luhnow and Sig Mejdal.[8] “Mejdal was one of Correa’s rivals” who worked with Correa in the Cardinal’s analytics department and now headed up the same department for the Astros.[9] Luhnow became the Astros’ general manager.[10]

The Astros operated an online database called Ground Control, along with an email system for their employees.[11] Ground Control housed “a variety of confidential data, including scouting reports, statistics, and contract information, all to improve the team’s scouting, communication, and decision-making for every baseball-related decision.”[12]

For at least a year, beginning in March 2013, Correa accessed Ground Control, along with the email account of Mejdal.[13] Correa had obtained Mejdal’s password when Mejdal turned over his laptop (and laptop password) to Correa when he left the Cardinals to join the Astros.[14] Mejdal used a similar password with the Astros, which Correa was able to determine and use to access Ground Control and Mejdal’s email.[15] Correa viewed confidential information in Ground Control including “[n]otes of the Astros’ trade discussions with other MLB teams; [r]eports of players in the Astros’ minor league system and their development; and [r]eports of team evaluators of players in the Astros’ system, and how these players were developing.”[16]

In 2014, the rivalry between Correa and Mejdal intensified after Sports Illustrated praised Mejdal and Luhnow, predicting the Astros would win the 2017 World Series.[17] With the intensified rivalry came continued hacking by Correa.[18]

Just days after the Sports Illustrated article was published, confidential notes from Astros’ trade talks were leaked to and published on Deadspin.com.[19] The Government contends that Correa leaked the notes to Deadspin.com.[20] The story spread quickly and “General Managers throughout Major League Baseball were forced to awkwardly reassure their players who had been reported as the subject of trade discussions.”[21] The Astros were humiliated and “issue[d] private apologies to every team in the league.”[22]

When the dust settled, the Astros had suffered financial and reputational loss. The Cardinals terminated Correa in July 2015.[23] In December of that year, the Government charged Correa with five counts of Unauthorized Access of a Protected Computer in violation of 18 U.S.C. 1030(a)(2)(C) & (c)(2)(B)(iii).[24] Correa pled guilty and was sentenced to 46 months in federal prison.[25]

The Astros filed a claim with the Office of the Commissioner pursuant to Article VI of the Major League Constitution.[26] The claim sought compensation from the Cardinals for Correa’s conduct.[27]

The MLB Commissioner’s investigation followed.

MLB Commissioner’s Powers

All disputes between Major League clubs must be arbitrated, subject to a few exceptions.[28] In such situations, the Commissioner shall serve as the arbitrator and his decision is final and non-appealable.[29] In fact, the clubs agree on behalf of themselves and their officers, directors, and employees, “to be finally and unappealably bound by actions of the Commissioner” and waive the right to litigate any dispute in court.[30]

Article II of the Major League Constitution enumerates the Commissioner’s powers.[31] Among those powers are the power “[t]o investigate, either upon complaint or upon the Commissioner’s own initiative, any act, transaction or practice charged, alleged or suspected to be not in the best interests of the national game of Baseball, with authority to summon persons and to order the production of documents, and, in case of refusal to appear or produce, to impose such penalties as are hereinafter provided.”[32] The Commissioner also has the power “[t]o determine, after investigation, what preventive, remedial or punitive action is appropriate in the premises, and to take such action either against Major League Clubs or individuals, as the case may be.” [33]

The Commissioner also has punitive powers, which may be imposed “[i]n the case of conduct by Major League Clubs, owners, offices, employees or players that is deemed by the Commissioner not to be in the best interests of Baseball.”[34] This punitive action can include one or more of the following:

a reprimand;

deprivation of a Major League Club of representation in Major League Meetings;

suspension or removal of any owner, officer or employee of a Major League Club;

temporary or permanent ineligibility of a player;

a fine, not to exceed $2,000,000 in the case of a Major League Club, not to exceed $500,000 in the case of an owner, officer or employee, and in an amount consistent with the then-current Basic Agreement with the Major League Baseball Players Association, in the case of a player;

loss of the benefit of any or all of the Major League Rules, including but not limited to the denial or transfer of player selection rights provided by Major League Rules 4 and 5; and

Decision

On January 30, 2017, the Commissioner issued his decision on the hacking investigation.[36] The Commissioner’s Order provided only a summary of his findings and decision, given the breadth and complexity of the investigation and to avoid disclosure of the Astros’ confidential and proprietary information.[37]

The Commissioner made three findings.

Mr. Correa was the only Cardinals employee who participated in the wrongful conduct[38]

The Cardinals were vicariously liable for Mr. Correa’s conduct “as a matter of MLB policy.”[39]

The Astros suffered material harm due to Mr. Correa’s conduct. While admitting that the potential competitive harm that the Astros suffered “is not amenable to precise quantification,” the Commissioner explained that “MLB Clubs fiercely compete” for talent.[40] So intense is this competition that the Commission found “as a matter of policy that a Club suffers material harm when an employee of another Club illegally accesses its confidential and proprietary information, particularly intrusions of the nature and scope present here.”[41]

Mr. Correa will be immediately placed on the “permanently ineligible list."[44]

Analysis

The Commissioner’s decision did not reveal co-conspirators within the Cardinals club.[45] Thus, under the decision, the entire club was not implicated in a larger conspiracy.

That being said, by ordering the Cardinals to forfeit to the Astros their top two 2017 draft picks and pay the Astros $2 million, the Commissioner made clear that even absent a larger conspiracy, the Cardinals club should be punished for Correa’s wrongful conduct. The Commissioner did so by finding the Cardinals vicariously liable for Correa’s conduct pursuant to MLB policy.[46]

The Commissioner’s punishment of the Cardinals for Correa’s conduct, without citing evidence of a larger conspiracy or evidence that anyone in the Cardinals’ front office knew he had hacked the Astros’ electronic systems, has received mixed reactions. Some commentators characterize the punishment as harsh, while others conclude that the Cardinals “got off easy.” The former recognize that the $2 million sanction is relatively high.[47] The latter, however, recognize that the order that the Cardinals forfeit their top two 2017 draft picks lacks teeth because the Cardinals had already surrendered their first round selection (pick #19) in the 2017 draft by signing free agent Dexter Fowler and were able to maximize their 2016 draft picks (given that the federal criminal case against Correa was still pending).[48]

No matter the opinions on the punishment’s fairness, the fact remains that the Cardinals organization was punished, as a matter of MLB policy, for the wrongful acts of a single employee found to be acting alone.

As for Correa, he criticized the Commissioner’s decision and defended his former employer, stating from prison:

“I am unimpressed with Major League Baseball’s commitment to the fair and just sanctions in this matter. The Cardinals were not the organization that benefited from unauthorized access.”[49]

This article is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting an attorney. Any views expressed herein are those of the author and not necessarily those of the law firm’s clients.

[9] Redacted Government Sentencing Report, Docket No. 45-2, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[10] Redacted Government Sentencing Report, Docket No. 45-2, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[17] Redacted Government Sentencing Report, Docket No. 45-2 at p.4, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[18] Redacted Government Sentencing Report, Docket No. 45-2 at pp. 4-6, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[19] Redacted Government Sentencing Report, Docket No. 45-2 at p. 6, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[20] Redacted Government Sentencing Report, Docket No. 45-2 at p. 6, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[21] Redacted Government Sentencing Report, Docket No. 45-2 at p. 6, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[22] Redacted Government Sentencing Report, Docket No. 45-2 at p. 6, United States v. Chris Correa, United States District Court for the Southern District of Texas, Case No. 4:15-cr-00679 (available through Pacer.gov).

[28] Major League Constitution at Art. VI, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[29] Major League Constitution at Art. VI, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[30] Major League Constitution at Art. VI, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[31] Major League Constitution at Art. II, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[32] Major League Constitution at Art. II, Sec. 2(b), Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[33] Major League Constitution at Art. II, Sec. 2(c), Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Court Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[34] Major League Constitution at Art. II, Sec. 3, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

[35] Major League Constitution at Art. II, Sec. 3, Docket No. 35-2, City of San Jose v. Office of the Commissioner of Baseball, United States District Court for the Northern District of California, Case No. 5:13-cv-02787-RMW (Available through Pacer.gov).

Copyright notice

Th​is work was written for and first published ​on LawInSport.com (unless otherwise stated) and the copyright is owned by LawInSport​ Ltd​. Permission to make digital or hard copies of this work (or part, or abstracts, of it) for personal​ use​ provided copies are not made or distributed for profit or commercial advantage, and provided that all copies bear this notice and full citation on the first page (which should include the URL, company name (LawInSport), article title, author name, date of the publication and date of use) of any copies made. Copyright for components of this work ​owned by parties other than​ ​LawInSport must be honoured.